VULNERABILITY INTELLIGENCE

CVE-2023-29508

CVSS score8.9 HIGH

EPSS probability0.42%

CISA KEVNot currently listed

Published2023-04-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Description

XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

Weakness classification

security-advisories@github.com: CWE-79
nvd@nist.gov: CWE-79

Primary references

security-advisories@github.com — Vendor Advisory
security-advisories@github.com — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Issue Tracking, Vendor Advisory